CI/CD pipeline runs on Compute Engine and manages infrastructure-as-code. How do you grant the pipeline appropriate permissions while following security best practices?

Creating multiple service accounts, one per pipeline, each with least-privilege IAM permissions, is the most secure approach. This adheres to the principle of least privilege, limiting the blast radius if a service account is compromised. Storing service account keys in Secret Manager is a best practice for securely managing credentials, allowing the pipeline to retrieve them at runtime without hardcoding. Attaching a single service account with minimal rights and allowing it to impersonate a Cloud Identity user is less secure because the impersonation mechanism introduces additional complexity and potential for privilege escalation if not managed perfectly. Adding a human approval step is good for governance but doesn't directly address the technical permissions of the automated pipeline. Attaching a single service account with all required permissions violates the principle of least privilege and creates a significant security risk.